Microsoft Malware Protection Center

This month we add another bot family to MSRT – Win32/Pushbot. Pushbot is, in many ways, an “old school” bot. It is controlled through IRC, it can distribute itself through several different channels and its source code is more or less open (for those who mix in certain circles). Like Win32/Rbot, Pushbot isn’t one piece of malware that is updated and maintained by one group of malware writers, but rather a collection of malicious programs created by different people based on a common base of source code. The core code of Pushbot is based on something called Reptile, which dates back to 2005. Reptile, in turn, appears to have been based on Win32/Sdbot, just as Win32/Rbot was.
 
Because they are created and released by different people, the functionality can vary from one instance to the next; however, the basic features are universal. They are all IRC bots at heart, although each may be controlled through a different IRC server. They all spread in one way or another. Spreading via instant messaging applications such as AIM and Windows Live Messenger was one of the defining features of the Pushbot family, but many recent variants have this functionality disabled, i.e. the code is present in the malware, but never executed. Like other recent MSRT additions Hamweq and Rimecud, current Pushbots copy themselves to removable drives along with an autorun.inf file to attempt to launch the malware when the drive is connected to another machine. As David mentioned in his Hamweq blog, Windows 7 effectively ignores autorun.inf entries for removable drives apart from CDs and DVDs. Follow these instructions to update earlier versions of Windows to behave the same way.
 
Pushbot’s raison d'être is the same as most bots – to control as many machines as possible. This control is mostly exploited by instructing infected machines to download other malware, which could be anything from password stealers to rogue security software. Some Pushbot variants can also be commanded to steal password information themselves, or launch distributed denial of service attacks.

-Hamish O’Dea

In a previous blog, I mentioned a family of malware named Dogrobot, which attempts to penetrate the protection offered by particular hardware that is widely used in Internet cafés in China. Interestingly, we recently discovered a trojan, TrojanDownloader:Win32/Chekafe.A, that checks whether an affected machine is in an Internet café or not. If the affected machine is not from an Internet café , it sends the MAC address of the affected machine to a remote server.
 
Leading me to ask two questions:

• How does it check if the affected host is in an Internet café or not?
• Why does it require this particular information?

For the first question, the answer is very simple. The malware checks for the presence of the following processes:

BarClientView.exe
Barclient.exe
EWay.exe
NBClient.exe
NxpAuxSvc.exe
clsmn.exe
mzdclient.exe
 
These processes are related to popular administration software used in Internet cafés in China.  If any of these processes are found, obviously, the affected system is most likely from an Internet café.
 
Now, the second question, why does it check for this? I pondered this for a while until I further investigated the samples that Chekafe downloads. I found most of the downloaded samples were password stealing trojans, including: PWS:Win32/Lolyda.AU, PWS:Win32/OnLineGames.FR, and PWS:Win32/OnLineGames.GP. Combined with the fact that it is sending the MAC address information, I realized that this kind of checking may be related to attempts to defeat an account protection mechanism -- MAC address binding.
 
Some popular online games offer the user MAC binding protection - the account can only be logged in from a certain computer (with a unique  MAC address). If the affected machine is from an Internet café, most likely the user won’t enable the MAC address binding for the account since they may not always use the same machine.
 
Otherwise, Win32/Chekafe.A sends the MAC address information so they can forge the same MAC address to bypass MAC address binding protection.
 
-Chun Feng

If you remember our MSRT related blog from few days ago (and if not just scroll down a bit), we informed you that in this month’s free removal tool we would be adding Win32/Rimecud to our list of prevalent malware targeted for removal. We even speculated about a possible connection between it and last month’s addition, Win32/Hamweq. This led us to belief that, given the high detection rate of Win32/Hamweq, we would have a new leader for January’s run of the removal tool. Not to our surprise, this actually happened.

Take a look at our 3-day-run top 20 families chart:

Position	Machine Count	Family	Notes
1	488,090	Rimecud	Worm targeting removable drives and instant messaging with backdoor functionality.
2	274,678	Hamweq	Worm targeting removable drives,  and IRC controlled backdoor
3	237,158	Taterf	Worm targeting network/removable drives, and online game PWS
4	169,562	Renos	Rogue antivirus downloader
5	124,572	Alureon	Data stealing malware that changes DNS settings
6	116,466	Conficker	Network worm and malware downloader
7	90,586	Bredolab	Downloader of numerous malware components
8	85,777	Bancos	Password Stealer targeting predominantly Brazilian banks
9	85,534	FakeSpypro	Rogue antivirus
10	85,018	FakeXPA	Rogue antivirus
11	68,942	Yektel	Rogue antivirus component related to FakeXPA
12	62,250	IRCbot	IRC controlled backdoor
13	61,602	Cutwail	Multiple component downloader and spammer
14	45,972	Brontok	Mass emailing worm
15	39,820	Frethog	Online game password stealer related to Taterf
16	36,637	PrivacyCenter	Rogue antivirus
17	25,931	Winwebsec	Rogue antivirus
18	24,795	Parite	File infecting virus
19	24,588	Jeefo	File infecting virus
20	24,207	FakeVimes	Rogue antivirus

According to the table above, first-ranked Win32/Rimecud had almost twice as many removals as second-ranked Win32/Hamweq. Below is a chart of top ten locales where Rimecud was found and cleaned:

From the table you can also notice that Taterf and Renos maintain a high profile while Conficker dropped in numbers slightly. Another family that declined in removals this month is Cutwail, from 6th to 13th position.

As usual, rogues are also present with FakeSpypro maintaining the 9th position as in December’s report, while FakeXPA dropped in removal numbers from 5th to 10th place. As an important note, we see PrivacyCenter as 16th in the list (it wasn't even a top family last month), ahead of Winwebsec, which had a moderate increase in numbers.

Please keep protecting yourself by running Microsoft Security Essentials, or any other reputable antivirus solution.

Marian Radu
MMPC Dublin

Following the addition of Win32/Hamweq to the MSRT last month, MMPC will continue cleaning PCs in 2010 by adding another prevalent worm, Win32/Rimecud, to this month's removal tool.
 
This is due not only to Win32/Rimecud's high detection numbers, which immediately follow those of Win32/Hamweq, but also to the similarities the two families share with each other.
 
In fact, as part of its payload, Win32/Hamweq may download Win32/Rimecud, contributing to Rimecud's suitability as the next target for MSRT.
 
Win32/Rimecud is a family of worms that spreads via fixed and removable drives, instant messaging programs, and P2P networks. Similar to Hamweq, it also contains backdoor functionality that allows unauthorized access to affected machines. However, compared to Hamweq, Win32/Rimecud's backdoor supports a more diverse and sophisticated set of commands, giving the remote attacker greater control of the compromised machine.
 
Win32/Rimecud uses a variety of obfuscators to hinder detection. These are written in C/C++/Delphi/Visual Basic and usually have virtual environment detection and anti-emulation tricks to make the malware harder to detect.
 
Other similarities to Win32/Hamweq's behavior include using the Recycle Bin as the target drop folder for copies of itself, injecting code into the explorer.exe process and the capability to spread via removable drives.
 
By looking at the similarities between the two threats we could speculate that they were created by the same author(s). Like they say: "Birds of a feather".
 
For more technical details about Win32/Rimecud please check our encyclopedia description here.
 
-Marian Radu

In the week since its release on December 8, MSRT has cleaned over 2.5 million machines of malware. The new family for December was Win32/Hamweq, an IRC controlled backdoor which spreads via removable drives. Hamweq was removed from 638,491 machines, making it the most prevalent family for the month, with around double the number of removals of Win32/Taterf, the next most prevalent family. Taterf, which is perennially one of the highest reported families by MSRT, also had more than twice the number of removals of the third most prevalent family.

Listed below are some of the families with high numbers of removals for this month.

Machines Cleaned	Family Name	Notes
638491	Hamweq	Worm targeting removable drives,  and IRC controlled backdoor
319998	Taterf	Worm targeting network/removable drives, and online game PWS
156549	Conficker	Network worm and malware downloader
104577	Renos	Rogue antivirus downloader
100050	FakeXPA	Rogue antivirus
98725	Cutwail	Multiple component downloader and spammer
90472	Alureon	Data stealing malware that changes DNS settings
72231	Frethog	Online game password stealer related to Taterf
62394	Bancos	Password Stealer targeting predominantly Brazilian banks
60109	FakeSpypro	Rogue antivirus
57645	Yektel	Rogue antivirus component related to FakeXPA
54908	Brontok	Mass emailing worm
51150	Koobface	Multiple component worm targeting social networking sites
43035	Bredolab	Downloader of numerous malware components
34029	Parite	File infecting virus
31441	IRCbot	IRC controlled backdoor
30400	Jeefo	File infecting virus
27964	Virut	File infecting virus with IRC controlled backdoor
24361	Zlob	Multiple component malware family that downloads arbitrary files
24057	RJump	Worm targeting removable drives
23950	Banker	Password Stealer targeting predominantly Brazilian banks
23377	Banload	Downloader of bank password stealers
22462	FakeVimes	Rogue antivirus
20564	Rustock	Rootkit enabled backdoor used to assist with sending of spam
19294	Vundo	Adware downloader
15814	Winwebsec	Rogue antivirus

Hamweq was prevalent across a wide range of locales worldwide – of the 199 locales where MSRT reported cleaning at least one system, 185 of them reported cleaning a Hamweq infection. Wherever a locale reported high numbers of machines cleaned of malware, reports of Hamweq were also generally high. The main exception to this was Chinese speaking countries, where reports were dominated by online game password stealing malware such as Taterf, Frethog, and Lolyda.

Locale	Machines cleaned (All Malware)	Locale	Machines Cleaned (Hamweq)
United States	644025	United States	155142
Brazil	171414	Spain	94888
Korea	156985	Brazil	41692
Spain	167575	Mexico	37771
France	79493	Korea	35874
Mexico	66904	Poland	25985
United Kingdom	63557	Portugal	23323
Taiwan	62616	France	18607
Poland	61817	Russia	15505
Turkey	57972	United Kingdom	13414
China	50730	Italy	9520
Russia	47467	Chile	8104
Italy	45362	Turkey	6818
Portugal	45210	South Africa	6554
Japan	43274	Australia	5979
Germany	39498	Germany	5853
Australia	19124	Colombia	5707
Netherlands	17830	Japan	5351
Chile	13710	Israel	4326
Canada	12678	Argentina	3622

December’s MSRT release also saw a significant drop in the number of reports for Win32/FakeScanti, a rogue antivirus that was added to MSRT in October. At the corresponding period in October, FakeScanti was the 12th most prevalent family, with removals from 56,700 machines. Shortly afterwards, FakeScanti’s authors stopped modifying the rogue to avoid detection by antivirus products, and as a result, we have not needed to add a signature for FakeScanti since October 26. In November, FakeScanti was the 23rd most prevalent family with 20,222 removals, whilst by December it had dropped to 49th with 1595 removals.

While FakeScanti’s authors may have moved their focus to developing other malware, the rogue can still be downloaded, and we have since seen other malware that installs FakeScanti on to affected systems. Similarly, Win32/FakeSecSen, which was the very first rogue we added to MSRT in November 2008, can still be downloaded even though it has not been updated since later that month, and is still being cleaned in small numbers by MSRT over a year later. This month FakeSecSen was the 54th most prevalent family with 1031 removals.

The fact that these rogues’ distributors find it worthwhile to continue to host malware that would be detected by most antivirus products shows that unprotected systems are still a rich target for those who would use them for profit, or for other nefarious activities. As usual, we recommend protecting yourself by running Microsoft Security Essentials, or any other reputable antivirus solution.

David Wood
MMPC Melbourne

...it might be because you weren't meant to.

Last year, the EOF virus-writing group decided to release a virus zine with the help of DoomRiderz and rRlf. Well, here is how that turned out: rRlf backed out of the project at the last minute and then folded, and DoomRiderz folded shortly after the zine was released. The zine itself contained some buggy contributions, and the majority of them were extremely primitive. The only new techniques came from the oldest of the virus writers.  One of those techniques was an unusual use of a CPU instruction, and the others were file-format tricks. They were certainly techniques that we weren't expecting to see, but nothing that our engines couldn't handle already.

There were some other interesting samples, too, though the reasons for their being interesting are varied. It was mostly because we identified numerous bugs in each sample (see, for example, Win32/Harumf). One of them was interesting for the extent in which it attempted to be anti-heuristic (Win/Zekneol).  One of them was interesting because it was a collection of old routines (Win/Satevis). None of them were a problem for our engines, though.

It's been more than a year since I started describing these samples in the Virus Bulletin journal. I've almost finished with the set, and perhaps just in time to start a new one: it seems that the EOF is at it again, only this time with a different group. VirusTech is a Russian group that announced the joint venture, but then went completely silent on the subject. Who knows if they will release anything this year?

As far as the proof-of-concept authors saving the virus scene, that didn't happen, either.

The virus writer known as herm1t did his thing with the file format tricks, but the virus code is still easy to reach and easy to scan. Of course, this wasn't the purpose of the demonstration (contrast that with his earlier Linux/Crimea virus family, whose code was not easy to reach, and which clearly was the purpose of the demonstration). We had two variants of a virus that overwrites the ".note.ABI-tag" section, four variants of a virus that overwrites (in different ways) the ".hash" section, a virus that adjusts the segment alignment, and a virus that overwrites the Procedure Linkage Table. It seems that he has run out of things to do with the file, at least for now.

These viruses are especially interesting because they are exploiting aspects of a file format that has no equivalent in Windows. It also shows that Linux and other Unix-based platforms (you know which ones I mean) are not immune to viruses.

After almost an entire year of silence, the virus writer known as roy g biv returned to the scene with... some text files.  His two new techniques, "Subtle SEH" and "Heaven's Gate" are certainly new and different, but also a coding dead-end. While the subtle registering of SEH might fool a human, these days it's all about the emulator, and the emulator is not fooled.  Heaven's Gate is even less of a problem, in a sense - it is using a gate to jump from a 32-bit environment into a 64-bit environment, assuming that the processor and operating system support it. I suppose that eventually we will see a virus that uses the technique, but if our emulator decides to not support that, then it simply won't run.  This situation is much like the use of SSE4.2 instructions that I described in The Power Of SSE. Oh, I mustn't forget to mention the virus for ODBGScript that is apparently by him, but I'm sure that the question on everyone's lips is - is it really him?  Okay, maybe not everyone's lips. At least some people will be asking "Do I care?"  Most recently was the release of a Hiew plugin virus for Hiew. It infects the file that Hiew is examining.

SPTH is also back after his retro detour of DOS virus material, and this time it's polymorphic fun with linear algebra.  Of course, it doesn't matter how variable the polymorphic part is, if the rest of it is constant, and that's what we have here. A huge, enormous, gigantic, colossal constant decryptor, followed by a huge, enormous, gigantic, colossal* polymorphic representation of the body. The only reason that it's polymorphic is because it's all text.  It's a script virus.  Keeping it simple is just one step away from retiring again. We're happy about that development.

One other development is from one of the newer members (Dark Prophet). He has apparently written a polymorphic, anti-heuristic, and anti-emulating virus that... well, I'll get to it eventually, but a quick glance has already shown me one serious bug. I've even received a request to describe it. How nice. I hope that it's because they think that I'll do a good job with it.

So that's the news in brief.

- Peter Ferrie
*with apologies to Roger Hargreaves and his "Mr Greedy" story.

This month, Worm:Win32/Hamweq has been added to the Malicious Software Removal Tool (MSRT)  in time for the holidays.  Hamweq makes it on to MSRT’s “naughty” list as an IRC-controlled backdoor that spreads via removable drives. It has multiple means of hiding its presence; it installs itself into a hidden directory which it disguises as a recycle bin, and, once run, it injects various code sections, and separately injects each of the encrypted strings it uses, into the explorer.exe process. This means it will not be shown separately on any list of running processes, and may also give it network access through any firewall that might be installed.

Hamweq periodically checks whether a removable drive has been attached, and if so, will copy itself to that drive, again using a directory that it disguises as a recycle bin. It also creates an autorun.inf file on the drive, containing an option to “Open folder to view files.”  This means that when the drive is subsequently attached to another system, the autoplay dialog will display two options that have this description. One of these will display the drive in Windows Explorer, whilst the other will run the malware. If the malware is launched from a removable drive, it also opens Windows Explorer, so users may not be able to spot the difference between the two options.

The worm connects to an IRC server – this allows the backdoor's controllers to give the gift of more malware, as the server may order Hamweq  to download and execute whatever files they see fit to install on the machine. Some variants of Hamweq may also be ordered to participate in Distributed Denial of Service attacks.

Microsoft’s latest Security Intelligence Report lists Hamweq as the second most prevalent distinct worm family reported by Forefront, our enterprise antivirus solution. Worms that spread via network shares or via removable drives tend to have large numbers of reports in the corporate environments, as these environments are usually highly networked, and because removable drives such as USB memory sticks are used often. Win32/Taterf, in spite of its payload being a password stealer for a number of different predominantly Chinese-language-based online role playing games, is another worm that is particularly prevalent in corporate environments worldwide (third most reported worm family by Forefront), regardless of the region, and the fact that most corporations would not have these games installed on their systems. Taterf, which is consistently one of the highest reported threats by MSRT, was found in high numbers in diverse regions such as Brazil, France, Russia, and South Africa.

You can reduce the effectiveness of these types of worms by ensuring that autorun content is not displayed in the autoplay dialog when removable or network drives are attached. For Windows 7, this is the default behavior (see: http://blogs.technet.com/srd/archive/2009/04/28/autorun-changes-in-windows-7.aspx). If you have an earlier version of Windows that is not already configured in this way, you can follow the instructions at:  http://support.microsoft.com/kb/971029. Alternatively, for Windows Vista or later, you can disable autoplay completely, or for particular types of media, via the “Hardware and Sound” section of the Control Panel.

David
MMPC Melbourne

 

In a recent blog posted on 18th November we talked about the significant threat that AV rogues had posed for our users this year.  Besides the prevalent rogues covered by the MSRT, the following is a longer list of AV rogues detected by Microsoft AV products such as Microsoft Security Essentials, Forefront Client Security, etc.

FakeXPA	FakePowav	MalwareBurn	UnSpyPc	DriveCleaner	DocrorTrojan
Winfixer	FakeScanti	Cleanator	MalwareCrush	PrivacyChampion	SystemLiveProtect
Yektel	FakeSmoke	Spyguarder	AntivirusGold	SystemGuard2009	WorldAntiSpy
SpywareSecure	IEDefender	MalWarrior	Malwareprotector	SpywareSoftStop	AntiSpyZone
Antivirus2008	PrivacyCenter	SpyLocked	Trojanguarder	MyBetterPC	NeoSpace
Winwebsec	FakeRemoc	SpywareStormer	SecurityiGuard	DoctorCleaner	UniGray
FakeSecSen	VirusRemover	Privacywarrior	PrivacyProtector	SpyBlast	FakeFreeAV
FakeRean	Antivirus2009	AntiSpywareDeluxe	Searchanddestroy	AlfaCleaner	WebSpyShield
InternetAntivirus	Antivirusxp	ErrorGuard	SpyCrush	Fakeav	Spyaway
WinSpywareProtect	Fakerednefed	Antispyware2008	EZCatch	EvidenceEraser	Vaccine2008
FakeSpypro	FakeCog	AntiVirGear	VaccineProgram	TrustCleaner	SearchSpy
AntiSpywareExpert	VirusRanger	SpyDawn	UltimateFixer	WinHound	Spyshield
SpySheriff	Antispycheck	SpywareIsolator	SpyFalcon	PrivacyRedeemer	VirusConst
FakeVimes	PCSave	PSGuard	SpywareStrike	Nothingvirus	AVClean
FakeIA	AntispyStorm	Antivirustrojan	XDef	AntiSpywareSoldier	AdsAlert
AdvancedCleaner	FakePccleaner	SpywareQuake	WareOut	Kazaap	SystemDefender
FakeSpyguard	SpyHeal	VirusBurst	VirusRescue	TitanShield	Easyspywarecleaner
Fakeinit	AntiVirusPro	CodeClean	Spybouncer	MalwareWar	VirusHeat
SpyAxe	Awola	MyNetProtector	FakeWSC	DoctorAntivirus	UltimateDefender

You may recognize some of the relatively recent rogues from this list such as FakeXPA, FakeSecSen and FakeRean. Some others, such as Winfixer and SpySheriff, have origins that actually go back to more than four years ago. On page 100 of our Security Intelligence Report volume 7, we observed that rogues remained a significant threat even though they trended down to 13.4 million infected computers in 1H09 from 16.8 million in 2H08. (Internet Explorer 8 SmartScreen Filter, a browser-based security feature, contributed to part of the decline).

As we have done in the past, we again encourage our readers to run a complete, up to date AV product such as Microsoft Security Essentials to protect their computers from these rogues, especially if located in English speaking countries - the regions where these rogues appear most active (as highlighted in the SIR). MSRT is a baseline tool we provide for the ecosystem to remove prevalent threats such as high profile rogues. With Security Essentials, on the other hand, you get the benefit of the complete AV signature set from the MMPC and you get the essential protection features an AV solution needs – real time, kernel mode detection, scheduled scan, complicated cleaning functionalities to address the emergent threats, etc.

Still, awareness of the threat event is also important. Take a look at some of the write-ups of these threats, get familiar with some of the enticing rogue skins used (like that displayed in the Win32/InternetAntivirus screenshot below) and tell your friends and families to be alert to the tricks used to socially engineer victims into opening their wallets for these 'useless at best' rogue AVs.

Scott Wu - MMPC

Almost a year ago, we started a project designed to monitor incoming attacks against a normal user on a day-to-day basis. We presented you with details about the geographical area from where the attacks originated and what services were targeted, and we gave you just a hint about FTP dictionary-based attacks. Now we’re going into a bit more detail about the passwords, having  so far gathered hundreds of user names and tens of thousands of passwords that have been  used in automated attacks in the last couple of months. Most of them were collected by our (fake) FTP server, which is designed to emulate a small part of the FTP protocol and log the information so that it’s easy to process.

As you can see below in the statistics, the length of the passwords is quite interesting, mainly because the average length according to our data is 8 characters and that’s quite close to the length of the passwords that many people use for their Internet accounts.

Statistics about user names and passwords:

• Longest user name: 15 chars
• Longest password: 29 chars
• Average user name length: 6 chars
• Average password length: 8 chars

Here is a top 10 list with the most common user names used in automated attacks:

User names	Count
Administrator	136971
Administrateur	107670
admin	8043
andrew	5570
dave	4569
steve	4569
tsinternetuser	4566
tsinternetusers	4566
paul	4276
adam	3287

And a similar list for passwords:

Passwords	Count
password	1188
123456	1137
#!comment:	248
changeme	172
F**kyou (edited)	170
abc123	155
peter	154
Michael	152
andrew	151
matthew	151

Trivia: One attacker tried more than 400,000 user name and password combinations.

Most of the probing is done from compromised systems that are connected to a password-protected IRC channel and are waiting for commands.

As you can see in the image below, one such command is to scan and identify other vulnerable hosts.

We just want to make users aware of the fact that passwords of around 8-10 characters (the average length of passwords that are normally used for Internet accounts) are used in attacks. Even a long password (10 to 15, or even 20 characters) isn’t good enough if it’s dictionary-based. As seen in the table above, there are passwords in dictionaries that are even using special characters (for example #!comment: ), not only numbers and letters.

You should take good care of what user name and password you're choosing. If your account has no limit on the number of login attempts, then knowing the user name is like having half of the job done. Especially for the user names from the top 10 (and mainly for the Administrator/Administrateur accounts), the passwords shouldn’t be picked lightly.

Usually we choose easy to type and/or easy to remember passwords, but please don’t forget that those passwords (for the moment) are the most commonly used or authentication on the Internet so they need to be strong.

The three basic things to remember when creating a strong password are the following:

1. Use a combination of letters, numbers and special characters. Also, remember that some dictionaries used in attacks have a "l33t" mode, which allows common letter/number-to-special character substitutions (like changing a-@, i-1 ,o-0 and s=$, for example, password = p@$$w0rd). Therefore, mix them in different ways so that they are not predictable.

2. Use a combination of upper and lower case letters.

3. Make it lengthy. A longer password does not necessarily mean it is strong but it can help in some cases.

To check if you have a strong password, you can use Microsoft's password checker (http://www.microsoft.com/protect/fraud/passwords/checker.aspx).

Having a super strong password is not enough. From time to time, you need to change it, especially when you feel that your account has been compromised. We also advise you to have several sets of passwords that differ in every account so in case one has been compromised not all your accounts will be affected.

For additional information regarding passwords you can visit the following links

Creating passwords - http://www.microsoft.com/protect/fraud/passwords/create.aspx

Maintaining passwords - http://www.microsoft.com/protect/fraud/passwords/secret.aspx

And by the way…..Don’t forget your password!!!!

 

Francis Allan Tan Seng && Andrei Saygo

By continuing to include new variants of the existing threat families, the MSRT has removed malware from more than 1.5 million machines three days after its release on 10 November.  This month we’ve also added Win32/FakeVimes and Win32/PrivacyCenter to the MSRT detection and have removed these new rogues from more than 110,000 machines. 

A lot of the top threat families are no strangers if you refer to our previous blog posts, or our recent published Security Intelligence Report.

• Out of these prevalent threat families worldwide, 8 are password stealers collecting online game credentials, online banking passwords or other user identities of users’ online accounts.
• 8 of them are fake security products or trojan downloaders for rogues.  The MSRT now covers the following most high profile rogues
• Win32/FakeVimes
• Win32/PrivacyCenter
• Win32/FakeScanti
• Win32/FakeSecsen
• Win32/FakeXPA
• Win32/Yektel
• Win32/Winwebsec
• Win32/InternetAntivirus
• Win32/FakeSpypro
• Win32/FakeRean
• 5 are trojan downloaders or droppers, a threat category which is often an infection vector to deliver drive-by malware to the victims’ computers.
• Win32/Koobface is still on top 25 though it has dropped out of top 10. Online Social Network sites such as Facebook continues to boost their security hardening to protect their customers and we welcome their actions.
• Win32/Zlob had dropped out of the list in recent months after being extremely prevalent for almost three years.  We observed that the Zlob authors appeared to move to somewhere else in our Oct 2008 blog and Jan 2009 blog.

Family	Computers Cleaned	Most Significant Category	Notes
Taterf	239,870	Worms	online game PWS
Alureon	141,358	Miscellaneous Trojans	data stealing trojans modifying DNS settings
Bancos	138,803	Password Stealers & Monitoring Tools	Brazil online banking PWS
Renos	115,970	Trojan Downloaders & Droppers	AV rogues downloaders
FakeXPA	96,466	Miscellaneous Trojans	AV rogues
Yektel	90,982	Trojan Downloaders & Droppers	AV rogues
FakeVimes	78,749	Miscellaneous Trojans	AV rogues
Cutwail	78,161	Trojan Downloaders & Droppers	Spambot
FakeSpypro	57,534	Miscellaneous Trojans	AV rogues
Frethog	54,764	Password Stealers & Monitoring Tools	online game PWS
Bredolab	48,323	Trojan Downloaders & Droppers	mass downloader
IRCbot	40,259	Backdoors	old spambot with traditional C&C
Vundo	38,481	Miscellaneous Trojans	adware downloaders
Koobface	36,300	Worms	web2.0 worm targets social networking sites
Brontok	35,531	Worms	mass-mailing e-mail worms
PrivacyCenter	34,726	Miscellaneous Trojans	AV rogues
Banker	28,293	Password Stealers & Monitoring Tools	Brazil online banking PWS
Banload	25,166	Password Stealers & Monitoring Tools	Brazil online banking PWS
Jeefo	23,887	Viruses	parasitic file-infector virus
Virut	22,549	Viruses	viruses evolved with backdoor behaviors
FakeRean	20,603	Miscellaneous Trojans	AV rogues
FakeScanti	20,222	Miscellaneous Trojans	AV rogues
Parite	20,076	Viruses	Prevalent viruses in Asia
Lolyda	19,210	Password Stealers & Monitoring Tools	online game PWS
RJump	18,452	Worms	Worm targeting removable devices

As usual we encourage you to run Microsoft Security Essentials, which contains the full AV signature set from the MMPC, or another reputable AV product, to protect your internet activities.

Scott Wu -- MMPC

The migration of PC computing from 32-bit to 64-bit is in full swing at last, and if you’ve been confused as to what it all means, you’re not alone.  PCs built for years now have been capable of running both 32-bit and 64-bit operating systems, but for that you need 64-bit version of Windows (and corresponding drivers for devices), and getting everything working on 64-bit used to be for brave and technical people only.

There are many advantages to using a 64-bit operating system – using twice as many bits can make computers faster and the maximum amount of memory that can be used goes way above the 4 gigabyte limit (that’s 2³² bytes). And 64-bit Windows includes Patchguard, which makes tampering with the Windows kernel (the part of the OS that makes the underlying hardware usable by software) much, much more difficult.

Most PCs shipping with Windows 7 come with the 64-bit versions of Windows, and finally there’s nothing to be confused about; these PCs just work.

As reported in the Security Intelligence Report, 64-bit Windows has some of the lowest reported malware infection rates in the first half of 2009:

There are still many threats that can affect 64-bit Windows, unfortunately. One other feature of 64-bit Windows is WOW64 – which is an acronym for Windows On Windows 64. WOW64 emulates a 32-bit Windows environment to allow software to run on the 64-bit operating system, which is great for compatibility with applications that haven’t ported to 64-bit yet, but also allows malicious code to grab a foothold. Even though these threats may run, since they’re running in the 32-bit emulated Windows environment they can do less to your computer, and don’t see 64-bit processes at all. For the same reason, 64-bit Windows needs 64-bit antimalware software like Microsoft Security Essentials to protect the whole computer.

Computer viruses are very confused by 64-bit. Taking a look at 64-bit executable code detected by Microsoft antimalware technologies in the past month, the vast majority is innocent 64-bit files infected by 32-bit viruses. While a 32-bit virus can only see other 32-bit processes, it unfortunately can see the file system, and can tamper with files it finds there. The 32-bit code in a 64-bit binary will immediately crash when executed. So even 64-bit Windows needs protection from malware.

There are also two remote control software packages that have been ported to 64-bit, which are potentially unwanted if you don’t know they are on your computer, and a couple of hacking tools that have been written for 64-bit.

Threat	Reports	Distinct Files
Virus:Win32/Virut	193954	11307
RemoteAccess:Win32/DameWareMiniRemoteControl	24672	16
Virus:Win32/Slugin	12817	2474
HackTool:Win32/Wpakill	9700	19
Virus:Win32/Gael	5033	2206
RemoteAccess:Win32/RemotelyAnywhere	388	111
Virus:Win32/Bacalid	82	36
HackTool:Win64/Welevate	25	3

   Table 1: Detected 64-bit binaries

Note that though the Microsoft Antimalware Engine may use the Win32 prefix for threat names, the technologies used can still locate malicious 64-bit code with signatures for 32-bit threats.

Overall, 64-bit malware is still exceedingly rare in the wild, and the additional protections built into 64-bit Windows will make it harder for malware to make the 64-bit jump that’s easy for PC users with Windows 7.

For a complete discussion of the PC threat landscape, see the Security Intelligence Report.

--Joe Faulhaber

Just over a week ago the Microsoft Malware Protection Center released the seventh edition of our Security Intelligence Report covering the first half of 2009.  Like all of our previous reports we have distilled information and insight from the wide array of telemetry we have available to us. New to this edition, however, is the inclusion of third party data and insight.  Specifically, we have worked with Shadowserver to include data collected for the Conficker Working Group (CWG) as well as insights from various Computer Emergency Response Teams (CERTs) worldwide. Microsoft is thankful for the many strong partnerships we have around the world and is committed to the industry collaboration typified by CWG as well as the programs in the Microsoft Security Response Alliance (MSRA).  MSRA is an umbrella program which is made up of similarly themed security programs for different constituencies. Some MSRA programs include the Microsoft Virus Initiative (MVI) and the Virus Information Alliance which are in place to provide technical guidance, malware sample exchange and support to other Anti-virus ISVs as well as the Security Cooperation Program (SCP) and SCPcert which relate to information exchange and collaboration with governments and with CERT organizations (governmental or non-governmental) in regions across the globe. 

We would specifically like to call your attention to content provided by several of our CERT partners. As you have likely seen from either my previous blog entry on this Security Intelligence Report or from the report itself or even previous reports we have released we do a comparative analysis of infection rates between countries. We’ve asked several CERTs from some of the countries with the lowest rates of infection to discuss factors to which they attribute the lower rate and their thoughts on associated best practices. Some very interesting things can be found in there (starting on page 44) such as the correlation between higher broadband penetration and adoption of security updates, the correlation between prevalence of pirated software and infection rate and, most importantly, the importance of industry collaboration in reducing the impact of malware in a region.

Download the report here:  http://www.microsoft.com/downloads/details.aspx?FamilyID=037f3771-330e-4457-a52c-5b085dc0a4cd&displaylang=en

Jeff Williams
(we want to hear from you—SIRFB at microsoft.com)

This month we’ve added two more rogue families to the Malicious Software Removal Tool (MSRT) – Win32/FakeVimes and Win32/PrivacyCenter. Both have been around since early 2009, but have become more prevalent in the last few months.

Win32/FakeVimes has gone through a lot of different names, usually with two or three active at any given time. Currently it’s calling itself Windows System Defender and Windows Enterprise Suite. Its interface may look familiar even if you’ve never had the misfortune of being affected by the malware - it has copied elements of the Windows Defender and Windows Security Center UIs and its activate* button includes an imitation of the Genuine Microsoft Software logo.

In addition to the usual reports of non-existent malware, some variants of FakeVimes display imitation User Account Control (UAC) dialogs, with a recommended option of “protect”. Clicking “protect” just leads to another dialog asking you to activate*. Sometimes FakeVimes also claims to detect spambot behaviour. In this case, it uses the Microsoft Office logo in an attempt to make its warnings appear more credible.

Win32/PrivacyCenter hasn’t gone through anywhere near as names as FakeVimes. It started off calling itself Privacy Center, changed to Privacy Components and now goes by Safety Center. PrivacyCenter looks quite primitive compared to most modern rogues. Sometimes it even reports its own files as malware.

Some variants of PrivacyCenter make themselves the default shell application, so when you reboot you might find that the trojan runs instead of Explorer.

Both Win32/FakeVimes and Win32/PrivacyCenter are distributed through fake online scanners, similar to those used by most other rogues.

-- Hamish O'Dea

* As with most rogues, “activate” means pay.